Our Liquidation Engine — how we significantly reduced the likelihood of clawbacks from ever occurring

You can see the specs here. You can also see a flowchart of the liquidation process here.

It’s first worth making explicit: the thing that causes socialized losses, and clawbacks, and auto-delevering, is when an account goes beyond bankrupt. If a user has a leveraged futures position on and markets move against their account enough that their net asset value is negative, then someone has to pay for that loss; and in crypto you can’t reposses assets from the bankrupt account’s owner from outside the system, so you’re stuck with other users — the users who aren’t getting liquidated — footing the bill.

Like most liquidation engines, the one FTX uses starts by detecting when a user has dropped below maintenance margin. Unlike many other platforms it chooses intelligent, efficient values for these — some other platforms, like OKEx, are fucked by the time a liquidation starts because their maintenance margin was too low and there is no way for them to liquidate such a large position so quickly.

We send reasonable, volume-limited liquidation orders to close down positions that drop below maintenance margin (which starts at 4.5% and increases with position size). We don’t sell so quickly that the liquidation orders themselves will crash the market; that would be dooming the entire process. We also don’t give up if the price looks ‘bad’ — it might only get worse from there and you have to do the best you can liquidating an account rather than hoping things magically reverse (as OKEx does).

Usually this is enough. But if there’s a large liquidation — say a long position (position B) that needs to get sold off — and markets are moving down too quickly, it might become clear that the normal liquidation orders in FTX’s orderbooks are unlikely to successfully close down position B before the account goes bankrupt.

In that case, the backstop liquidity provider system kicks in. In this situation, liquidity providers who have opted in to the system will internalize position B, taking over the whole obligation and collateral. They’ll do this before the account actually goes bankrupt so they have a chance to successfully manage the position. They will then go hedge their books on other venues. This effectively allows the backstop liquidity providers to instantly inject liquidity from other exchanges into FTX in an emergency, removing the dangerous account’s position from FTX’s books and preventing a likely bankrupcy.

It’s worth noting here the difference between the role that an insurance fund plays from the role that a liquidity provider plays. If someone has a long $200m BTC position that’s bankrupt you can try to pay for it’s net losses out of an insurance fund. But if that’s all you have, it doesn’t fix the problem that the user still has that $200m position — and so if markets keep moving the insurance fund will just keep losing more and more and more. The way to actually end a liquidation is for someone to take that position of the client’s hands — that is someone to actually take on the long $200m of BTC exposure. In this way the backstop liquidity provider program solves a problem that no insurance fund can solve, no matter how large.

Hopefully, the backstop liquidity provider program will be enough to prevent any clawbacks from occurring. In our testing, even market moves of 40% in a 20 minute period were not enough to cause clawbacks; the combination of on-exchange liquidity and backstop liquidity providers were able to provide to all of the nearly bankrupt accounts before they went under. In fact the insurance fund actually gained about $1m in most of these scenarios.

But there needs to be a worst case scenario. And if all else fails, FTX will do what other exchanges do — it will auto-delever an account’s position against accounts that have the opposite position on, and attempt to cover any losses out of the insurance fund; and if the insurance fund runs dry then there will be clawbacks.

But FTX really does see clawbacks as a worst case scenario that we hope never happens. We designed a system that we think will withstand huge market moves and huge volume without leading to any clawbacks. And if there’s ever a clawback on FTX, we fucked up. We will apologize, write a detailed post explaining the mistakes we made to get the market to the point that clawbacks were necessary, and issue IOUs against future insurance fund increases for any shortfall.

Because that’s what should happen if an exchange loses customers’ money, even if it’s far from the norm right now.

Anyway — that’s the FTX manifesto on liquidations. How are our competitors doing?

We’d like to start by explicitly saying that all things considered BitMEX has done a good job at preventing clawbacks. There are occasional auto-deleveragings and socialized losses on the illiquid altcoin contracts but they’re rare and the BTC perpetual swaps — the one really liquid product on BitMEX — virtually never sees them.

But OKEx is in a pretty bad state. There was a well-publicized $9m clawback on July 31st 2018. Quoting from OKEx’s official blog post on the incident:

1. OKEx saw this as business as usual: “OKEx has adopted the societal loss risk management mechanism since launched and it has been working orderly as intended.”
2. OKEx’s attempt to address the situation: “Our risk management team immediately contacted the client, requesting the client several times to partially close the positions to reduce the overall market risks. However, the client refused to cooperate…”
3. If OKEx was not going to be able to handle the order why did they let the client place it? OKEx’s risk systems are woefully inadequate.
4. “Shortly after this preemptive action, unfortunately, the BTC price tumbled, causing the liquidation of the account.”
5. OKEx seems not to be fully aware of why the BTC price tumbled. “Unfortunate” is one way of putting it; “in response to OKEx manually placing a $400m liquidation offer and hoping against hope someone would trade against it — but instead seeing the market update on the expected impact of the order” is another. OKEx caused the move that caused the clawback.
6. “We will implement a series of risk management enhancements, which are in line with our futures roadmap released on July 17, 2018, to prevent any similar cases from occurring again.” So how has this new framework done?
7. On 2018–11–23 OKEx clawed back 50% of profit from ETC futures, or over $1m.
8. On 2018–09–07, OKEx clawed back 18% of profit from EOS futures, or over $3m.
9. OKEx’s BSV futures went through a 6 week stretch from 2018–12–28 to 2019–02–01 where the average clawback was 42%.
10. The now-delisted OKEx BTG futures went through periods of having over 80% clawbacks each week — meaning that nearly the entire trading in the futures was someone going bankrupt!
11. And, infamously, a few days before the BCH fork OKEx emergency settled their futures early — without notice — to a marked to market price in a downlimit future trading against the wrong index, leading to roughly $20m of losses.
12. Huobi’s product, HBDM, has not yet had clawbacks — to their credit. But their product is only a month old; and given that the product was copy-pasted from OKEx’s, it should not be expected to withstand the test of time.

You can see our specs here. You can also see a flowchart of our liquidation process here.